USN-6624-1: Linux kernel vulnerabilities
Marek Marczykowski-Górecki discovered that the Xen event channel infrastructure implementation in the Linux kernel contained a race condition. An attacker in a guest VM could possibly use this to cause a denial of service (paravirtualized device unavailability). (CVE-2023-34324) Zheng Wang discovered a use-after-free in the Renesas Ethernet AVB driver in the Linux kernel during device removal. A privileged attacker could use this to cause a denial of service (system crash). (CVE-2023-35827) Tom Dohrmann discovered that the Secure Encrypted Virtualization (SEV) implementation for AMD processors in the Linux kernel contained a race condition when accessing MMIO registers. A local attacker in a SEV guest VM could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-46813) It was discovered that the iouring subsystem in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46862) It was discovered that the netfilter subsystem in the Linux kernel did not properly validate inner tunnel netlink attributes, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-5972) It was discovered that the TLS subsystem in the Linux kernel did not properly perform cryptographic operations in some situations, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6176) Jann Horn discovered that a race condition existed in the Linux kernel when handling iouring over sockets, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-6531) Xingyuan Mo discovered that the netfilter subsystem in the Linux kernel did not properly handle dynset expressions passed from userspace, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-6622) It was discovered that the TIPC protocol implementation in the Linux kernel did not properly handle locking during tipccryptokeyrevoke() operations. A local attacker could use this to cause a denial of service (kernel deadlock). (CVE-2024-0641)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1007-starfiveto a version that resolves this vulnerability.Fixed in 6.5.0-1007.8 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1009-laptopto a version that resolves this vulnerability.Fixed in 6.5.0-1009.12 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1010-raspito a version that resolves this vulnerability.Fixed in 6.5.0-1010.13 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1013-awsto a version that resolves this vulnerability.Fixed in 6.5.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1013-gcpto a version that resolves this vulnerability.Fixed in 6.5.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1015-oracleto a version that resolves this vulnerability.Fixed in 6.5.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-genericto a version that resolves this vulnerability.Fixed in 6.5.0-17.17 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-generic-64kto a version that resolves this vulnerability.Fixed in 6.5.0-17.17 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-lowlatencyto a version that resolves this vulnerability.Fixed in 6.5.0-17.17.1 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.5.0-17.17.1 - Upgrade
Upgrade
ubuntu/linux-image-awsto a version that resolves this vulnerability.Fixed in 6.5.0.1013.13 - Upgrade
Upgrade
ubuntu/linux-image-gcpto a version that resolves this vulnerability.Fixed in 6.5.0.1013.13 - Upgrade
Upgrade
ubuntu/linux-image-genericto a version that resolves this vulnerability.Fixed in 6.5.0.17.19 - Upgrade
Upgrade
ubuntu/linux-image-generic-64kto a version that resolves this vulnerability.Fixed in 6.5.0.17.19 - Upgrade
Upgrade
ubuntu/linux-image-generic-lpaeto a version that resolves this vulnerability.Fixed in 6.5.0.17.19 - Upgrade
Upgrade
ubuntu/linux-image-kvmto a version that resolves this vulnerability.Fixed in 6.5.0.17.19 - Upgrade
Upgrade
ubuntu/linux-image-laptop-23.10to a version that resolves this vulnerability.Fixed in 6.5.0.1009.12 - Upgrade
Upgrade
ubuntu/linux-image-lowlatencyto a version that resolves this vulnerability.Fixed in 6.5.0.17.17.14 - Upgrade
Upgrade
ubuntu/linux-image-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.5.0.17.17.14 - Upgrade
Upgrade
ubuntu/linux-image-oracleto a version that resolves this vulnerability.Fixed in 6.5.0.1015.15 - Upgrade
Upgrade
ubuntu/linux-image-raspito a version that resolves this vulnerability.Fixed in 6.5.0.1010.11 - Upgrade
Upgrade
ubuntu/linux-image-raspi-nolpaeto a version that resolves this vulnerability.Fixed in 6.5.0.1010.11 - Upgrade
Upgrade
ubuntu/linux-image-starfiveto a version that resolves this vulnerability.Fixed in 6.5.0.1007.9 - Upgrade
Upgrade
ubuntu/linux-image-virtualto a version that resolves this vulnerability.Fixed in 6.5.0.17.19 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-1014-oemto a version that resolves this vulnerability.Fixed in 6.5.0-1014.15 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-genericto a version that resolves this vulnerability.Fixed in 6.5.0-17.17~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-generic-64kto a version that resolves this vulnerability.Fixed in 6.5.0-17.17~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-lowlatencyto a version that resolves this vulnerability.Fixed in 6.5.0-17.17.1.1.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-6.5.0-17-lowlatency-64kto a version that resolves this vulnerability.Fixed in 6.5.0-17.17.1.1.1~22.04.1 - Upgrade
Upgrade
ubuntu/linux-image-generic-64k-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.5.0.17.17~22.04.9 - Upgrade
Upgrade
ubuntu/linux-image-generic-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.5.0.17.17~22.04.9 - Upgrade
Upgrade
ubuntu/linux-image-lowlatency-64k-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.5.0.17.17.1.1.1~22.04.6 - Upgrade
Upgrade
ubuntu/linux-image-lowlatency-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.5.0.17.17.1.1.1~22.04.6 - Upgrade
Upgrade
ubuntu/linux-image-oem-22.04dto a version that resolves this vulnerability.Fixed in 6.5.0.1014.16 - Upgrade
Upgrade
ubuntu/linux-image-virtual-hwe-22.04to a version that resolves this vulnerability.Fixed in 6.5.0.17.17~22.04.9
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the severity of USN-6624-1?
The severity of USN-6624-1 is categorized as a denial of service vulnerability.
How do I fix USN-6624-1?
To fix USN-6624-1, you need to upgrade to the specified patched versions of the affected Linux kernel packages.
Who discovered the vulnerability USN-6624-1?
The vulnerability USN-6624-1 was discovered by Marek Marczykowski-Górecki.
What systems are affected by USN-6624-1?
The vulnerability USN-6624-1 primarily affects Ubuntu systems running specific versions of the Linux kernel.
What is the impact of the vulnerability USN-6624-1?
The impact of the vulnerability USN-6624-1 allows an attacker in a guest VM to potentially create a denial of service through paravirtualized device unavailability.